Sounds like the way to go. I guess it didn't even cross my mind that the N900 on T-Mobile is probably NATed. Reverse SSH tunnel FTW. So honestly, dyndns isn't necessary on the N900, you're not going to connect to the N900 directly, but rather go through a webhost which would actually be the server needing a Dyndns client on it.